# Story 2.6.4: Implement PUT /credentials/{id}

<!-- Powered by BMAD™ Core -->

## Status
**Draft**

## Story

**As a** workflow automation user,
**I want** to update existing credentials through the MCP server,
**so that** I can modify authentication details when API keys rotate or configuration changes without recreating credentials and updating all workflows.

## Acceptance Criteria

1. New `update_credential` MCP tool registered and functional
2. Tool supports full credential replacement (PUT semantics)
3. Credential data can be updated while preserving ID
4. Multi-instance routing works correctly
5. Error handling for non-existent credentials (404)
6. Error handling for invalid update data (400)
7. Workflows using credential continue working after update
8. Comprehensive testing with various update scenarios
9. Documentation with update examples
10. Credential update validation complete

## Tasks / Subtasks

### Task 1: Implement updateCredential (AC: 1, 2, 4)
- [ ] Add `updateCredential` method to N8NApiWrapper
- [ ] Use callWithInstance pattern
- [ ] Use PUT for full replacement
- [ ] Support credentialId and update data
- [ ] Add error handling

### Task 2: Register update_credential Tool (AC: 1)
- [ ] Add tool definition to src/index.ts
- [ ] Define input schema
- [ ] Include credentialId and credential data
- [ ] Add instance parameter
- [ ] Implement request handler

### Task 3: Update Logic (AC: 2, 3)
- [ ] Full credential replacement
- [ ] Preserve credential ID
- [ ] Update name, type, data fields
- [ ] Validate update structure
- [ ] Test update semantics

### Task 4: Create Tests (AC: 8)
- [ ] **Test 4.1**: Update credential name
  - [ ] Change name only
  - [ ] Verify name updated
  - [ ] Check other fields unchanged
- [ ] **Test 4.2**: Update credential data
  - [ ] Update authentication details
  - [ ] Verify data persisted
  - [ ] Test encrypted storage
- [ ] **Test 4.3**: Update credential type
  - [ ] Change credential type
  - [ ] Verify type conversion
  - [ ] Document behavior
- [ ] **Test 4.4**: Full credential replacement
  - [ ] Replace all fields
  - [ ] Verify complete update
  - [ ] Check ID preserved
- [ ] **Test 4.5**: Workflow impact test (AC: 7)
  - [ ] Create workflow using credential
  - [ ] Update credential
  - [ ] Verify workflow still works
  - [ ] Test execution succeeds
- [ ] **Test 4.6**: Multi-instance update
  - [ ] Update in default instance
  - [ ] Update in specific instance
  - [ ] Test cross-instance (404)
- [ ] **Test 4.7**: Error scenarios
  - [ ] Update non-existent credential (404)
  - [ ] Invalid update data (400)
  - [ ] Malformed request
- [ ] **Test 4.8**: Update idempotency
  - [ ] Update twice with same data
  - [ ] Verify no issues

### Task 5: Documentation (AC: 9)
- [ ] Update examples
- [ ] Document PUT semantics
- [ ] Workflow impact notes
- [ ] Update README and CHANGELOG

### Task 6: Integration (AC: 10)
- [ ] Add to test suite
- [ ] Integration tests
- [ ] Cleanup utilities

## Dev Notes

### Update Request Structure
```typescript
{
  credentialId: string;
  credential: {
    name: string;
    type: string;
    data: object;
  }
}
```

### PUT vs PATCH
**PUT** (This story): Full replacement
- All fields must be provided
- Missing fields will be removed/reset
- Complete credential specification required

**PATCH** (Not implemented): Partial update
- Only specified fields updated
- Unspecified fields unchanged
- NOT part of this story

## Testing

### Test Pattern
```javascript
// Original credential
const original = await createCredential({
  name: 'Original',
  type: 'httpBasicAuth',
  data: { user: 'old', password: 'old' }
});

// Update credential
const updated = await updateCredential(original.id, {
  name: 'Updated',
  type: 'httpBasicAuth',
  data: { user: 'new', password: 'new' }
});

assert(updated.id === original.id);
assert(updated.name === 'Updated');
```

## Change Log

| Date | Version | Description | Author |
|------|---------|-------------|--------|
| 2025-12-26 | 1.0 | Story created for PUT /credentials/{id} | Sarah (PO) |